Hello, World! A cyber crime group, “RansomedVC” has claimed on their dark web site to have
“successfully compromised all of Sony’s systems”, and says they’re going to sell all the data
they’ve stolen thanks to “sony not wanting to pay” a ransom. This sounds really pretty bad,
I mean - in the past Sony has been absolutely crippled by a couple of
very well known cyber attacks, in 2011 they were forced to shutdown PlayStation network
for almost an entire month and in 2014 North Korean hackers stole unreleased films after
they hacked Sony. Could this attack be number 3? Well, who are the attackers here? ‘RansomedVC’
is a cyber extortion gang which only hacked their first victim less than a month ago, so these guys
are pretty much brand new. In fact they’re so new that ‘RansomedVC’ keeps flip flopping about what
they even are. If you browse the wayback machine you’ll find that just last month,
they announced that they were setting up a brand new cyber crime forum ‘RansomForums’, with the
forum launching the very next day, but just a few days later they decided that they didn’t want to
run a forum anymore, and instead launched Ransomed, an “online agency that is looking
forward to put sanctions on the less that dared not to pay”. If we put the slight grammatical
errors to one side here, we have what looks like a very primitive ransomware gang blog page, listing
their first few victims. A couple days later they updated their site again, and then a few
days after that they updated their site yet again. If you’ve ever hosted a website you’ll be familiar
with being indecisive about what you want it to look like, maybe even scrapping your idea for
a domain altogether and coming up with something totally different just a couple days later. That’s
these guys - I just don’t get the feeling that they’ve got much experience being cyber criminals,
but they settled on this about a month ago, and ever since then have been posting updates
on new victims they hacked every few days. So far their alleged victims have
mostly been rather small fish, but this Sony hack could definitely change that.
But are they being honest with us when they say they compromised all of Sony? I mean, Sony
isn’t one company, there’s Sony Pictures, Sony Financial Group, Sony Interactive Entertainment,
and so on… The 2014 hack that saw North Korean hackers stealing unreleased films,
targeted Sony Pictures, and the 2011 hack that resulted in Playstation network being
taken offline for almost a month, targeted Sony interactive entertainment … so for
these guys to say they’ve hacked all of Sony, as if there’s a single server out
there which has all the Sony things on it, just doesn’t make any sense.
But the miscreants posted proof, screenshots of a developer’s PC, a powerpoint presentation
detailing some kind of virtual machine setup, and a document tree - showing the names of 6000
files they nabbed from Sony, which hints that the breach contains things like code,
documentation, and build logs - in other words, not very high value data. I mean - there’s no
evidence of highly embarrassing leaked conversations between Sony executives
like we were treated to in the 2014 hack, but maybe I’m missing something because in the
wake of RansomedVC announcing the hack, the interwebs had an absolute meltdown.
Sony has just been hacked, and if it’s as bad as we think it is could mean playstation
network getting shut down again. Yep, your credit card, addresses and all personal
data will all be sold in exactly 2 days and there’s nothing you can do. Good news is,
if you can call it that, that only 6000 accounts have been affected so far
The logic behind this level of reaction from TikTokers is really straightforward.
In their mind, Sony owns Playstation, so if Sony is hacked, then Playstation must have been hacked,
and if PlayStation is hacked, then that must mean they can’t play their videogames. But while
TikTok was going through their silly little meltdown, there was a twist in this story.
Because someone going by ‘MajorNelson’ posted on breachforums, saying “You journalists
believe the ransomware crew for lies. Far too gullible, you should be ashamed. RansomedVCs
are scammers who are just trying to scam you and chase influence. Enjoy the leak.” Then he
posted the full data breach for free. A 2.5GB archive… but what does it contain?
Well, if you run a simple search for instances of ‘password’ you’ll find a decent few passwords,
but based on the context, a lot of these look like passwords for test setups rather
than keys to the next Sony pictures films. There are decent few email addresses in here,
along with a bunch of code, and other things, all of which could potentially be leveraged
to facilitate possible future breaches - maybe, but there’s nothing to warrant the
level of meltdown that took place on TikTok - Playstation Network isn’t getting shut down,
and no ones got access to your credit card details. The bad guys seem to have just gained
access to some arbitrary server responsible for automating the building and deploying of code,
potentially for just some very boring software that Sony runs.
But who ‘MajorNelson’ is and why they would want to crash ‘RansomedVC’s’ party, is a bit of a
mystery, the account quite literally spawned just to make this post and hasn’t been online since.
However I spoke with someone who has some inside information, someone I confirmed is a mod on the
current version breachforums. He claims to know the leader of ‘RansomedVC’ and said that these
guys don’t really hack anyone themselves, but rather just buy initial access to them on some
dark web - which he said explains ‘MajorNelson’, as just someone else who bought access to the
same Sony server as them. And the ‘Ransomed’ in ‘RansomedVC’ is a bit misleading because he said
that these guys, just extort victims, there’s no encrypting of files going on here at all,
as that’s something that they’re still working on. He had a lot to say about the identity of
the individual behind this operation and their links to other illicit operations,
however in the time I had available to make this video, I just wasn’t able to verify those
claims - and I only want to relay information to you guys that I can be reasonably sure of,
but that might all come up in a future video. There’s been no reaction from ‘ransomedVC’
to the brief TikTok meltdown they caused. But by all accounts the group still seems
to be operating, but their darkweb site and clearnet mirror aren’t very stable,
often going offline - but that wouldn’t have been the case if they’d used a reliable hoster
like today’s sponsor Akamai connected cloud. Akamai connected cloud is your swiss army
knife for cloud computing, these guys can handle everything cloud, and they’re giving
you a $100 60 day credit to get started. One of their features that I love is their
app marketplace which makes it super easy to spin up servers with preconfigured software.
Need an instance of Kali? Just configure the basics with their installer and you’re done.
So click the link in the description now to claim you’re free $100 credit.
As always thanks for watching, and I’ll see you in the next video, have a good one.